Problema virus Msn ma diverso dal solito

[maury86]

Quei file non li ho trovati in system 32....
Comunque ho fatto la scansione online con kaspersky in windows per ora trovando questo:

nfected Object Name / Virus Name / Last Action
C:\WINDOWS\CorelStorage.exe Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\perfmon.exe Infected: Trojan-Downloader.Win32.Small.fee skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.lo g Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\atapi.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_430.dat Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\DOCUME~1\WinXP\IMPOST~1\Temp\PXR12.tmp Object is locked skipped
C:\DOCUME~1\WinXP\IMPOST~1\Temp\PXR13.tmp Object is locked skipped
C:\DOCUME~1\WinXP\IMPOST~1\Temp\PXR14.tmp Object is locked skipped
C:\DOCUME~1\WinXP\IMPOST~1\Temp\PXR17.tmp Object is locked skipped
C:\DOCUME~1\WinXP\IMPOST~1\Temp\PXRE.tmp Object is locked skipped
C:\DOCUME~1\WinXP\IMPOST~1\Temp\PXRF.tmp Object is locked skipped
C:\DOCUME~1\WinXP\IMPOST~1\Temp\~DFE3C5.tmp Object is locked skipped

Solo che la versione trial non prevede l'eliminazione di virus

[ste_95]

scarica avenger, estrailo, aprilo, vai su input script maually, poi sulla lente e inserisci queste righe:

Files to delete:
C:\WINDOWS\perfmon.exe

poi su done, poi sul semaforino verde, acconsenti, a questo punto il computer dovrebbe riavviars, altrimenti fallo tu manulmente...
al riavvio ti si aprirà il blocco note, copiane il contenuto qui...

fai anche un'altra scansione online ma di tutto il computer

come va adesso?

[maury86]

Forse non ci hai fatto caso ma sul primo post avevo scritto che programmi come avenger oppure hithisjack non riesco ad aprirli perchè quando li apro me li chiude immediatamente e mi si riavvia explorer...Infatti sono un po nei casini e non riesco a capire il perchè.

[ste_95]

nemmeno da provvisoria?

intanto fai la scansione completa con kaspersky online...

[maury86]

Questo è il report della scansione completa


Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\WinXP\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\WinXP\Dati applicazioni\Mozilla\Firefox\Profiles\0wbolmvc.def ault\cert8.db Object is locked skipped
C:\Documents and Settings\WinXP\Dati applicazioni\Mozilla\Firefox\Profiles\0wbolmvc.def ault\history.dat Object is locked skipped
C:\Documents and Settings\WinXP\Dati applicazioni\Mozilla\Firefox\Profiles\0wbolmvc.def ault\key3.db Object is locked skipped
C:\Documents and Settings\WinXP\Dati applicazioni\Mozilla\Firefox\Profiles\0wbolmvc.def ault\parent.lock Object is locked skipped
C:\Documents and Settings\WinXP\Dati applicazioni\Mozilla\Firefox\Profiles\0wbolmvc.def ault\search.sqlite Object is locked skipped
C:\Documents and Settings\WinXP\Dati applicazioni\Mozilla\Firefox\Profiles\0wbolmvc.def ault\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\WinXP\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\WinXP\Impostazioni locali\Cronologia\History.IE5\MSHist01200708282007 0829\index.dat Object is locked skipped
C:\Documents and Settings\WinXP\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\WinXP\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\WinXP\Impostazioni locali\Dati applicazioni\Mozilla\Firefox\Profiles\0wbolmvc.def ault\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\WinXP\Impostazioni locali\Dati applicazioni\Mozilla\Firefox\Profiles\0wbolmvc.def ault\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\WinXP\Impostazioni locali\Dati applicazioni\Mozilla\Firefox\Profiles\0wbolmvc.def ault\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\WinXP\Impostazioni locali\Dati applicazioni\Mozilla\Firefox\Profiles\0wbolmvc.def ault\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\WinXP\Impostazioni locali\Temp\PXR12.tmp Object is locked skipped
C:\Documents and Settings\WinXP\Impostazioni locali\Temp\PXR13.tmp Object is locked skipped
C:\Documents and Settings\WinXP\Impostazioni locali\Temp\PXR14.tmp Object is locked skipped
C:\Documents and Settings\WinXP\Impostazioni locali\Temp\PXR17.tmp Object is locked skipped
C:\Documents and Settings\WinXP\Impostazioni locali\Temp\PXRE.tmp Object is locked skipped
C:\Documents and Settings\WinXP\Impostazioni locali\Temp\PXRF.tmp Object is locked skipped
C:\Documents and Settings\WinXP\Impostazioni locali\Temp\~DFE3C5.tmp Object is locked skipped
C:\Documents and Settings\WinXP\Impostazioni locali\Temporary Internet Files\Content.IE5\83GVKX0D\backup[1].zip Infected: Trojan-Downloader.Win32.Small.fee skipped
C:\Documents and Settings\WinXP\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\WinXP\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\WinXP\ntuser.dat.LOG Object is locked skipped
C:\Programmi\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Programmi\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Programmi\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped
C:\Programmi\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
C:\Programmi\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Programmi\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Programmi\Alwil Software\Avast4\DATA\report\Protezione residente.txt Object is locked skipped
C:\Programmi\File comuni\System\PFZ.exe Object is locked skipped
C:\RECYCLER\NPROTECT\00233434.exe Object is locked skipped
C:\RECYCLER\NPROTECT\00236158.exe Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{7E6FE561-13CF-4F33-A583-8BB3EB8B9623}\RP192\A0061647.exe Object is locked skipped
C:\System Volume Information\_restore{7E6FE561-13CF-4F33-A583-8BB3EB8B9623}\RP192\A0062636.exe Object is locked skipped
C:\System Volume Information\_restore{7E6FE561-13CF-4F33-A583-8BB3EB8B9623}\RP192\A0063602.exe Object is locked skipped
C:\WINDOWS\CorelStorage.exe Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\perfmon.exe Infected: Trojan-Downloader.Win32.Small.fee skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.lo g Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\atapi.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_430.dat Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped


Comunque ho provato a lanciare hijackthis in modalità provvisoria ma mi fa sempre la solita cosa, cioè mi chiude subito la finestra e si riavvia explorer

[ste_95]

prova a eliminare questi due files manualmente in modalità provvisoria...:

C:\Documents and Settings\WinXP\Impostazioni locali\Temporary Internet Files\Content.IE5\83GVKX0D\backup[1].zip

C:\WINDOWS\perfmon.exe --> il quale con un paio di ricerche è un virus di msn...

http://www.sur-la-toile.com/viewTopi...VIRUS-SUR-MSN-(Fichier-.zip).html

come va?

[maury86]

Scusa per la mia ignoranza ma come faccio a togliere quei 2 file manualmente in modalità provvisoria? Basta che li cerco e poi li elimino?
Comunque quel sito che mi hai dato non va

[ste_95]

si basta che li trovi e li cancelli...

ecco il sito:

http://www.sur-la-toile.com/viewTop..._VIRUS-SUR-MSN-(Fichier-.zip).html

[maury86]

Allora il file backup l'ho eliminato mentre C:\WINDOWS\perfmon.exe me lo trova sotto la cartella system 32 di windows, cosa devo fare, lo elimino comunque?
Quel sito che mi hai dato continua a non funzionarmi, mi da errore 404, object not found. Ma cosa c'è su quel sito? Grazie mille!!!

[ste_95]

eliminalo anche se è in system32...

prova adesso